Adobe Commerce, Adobe Commerce B2B, Adobe Magento Open Source, Adobe Commerce Events

What this is

Adobe Commerce has a flaw that allows dangerous types of files to be uploaded. This can let an attacker run their own program with the current user's permissions.

How it can harm you

An attacker does not need to sign in, but the victim must open a malicious link or interact with a compromised web page. The attacker could run their own program with the current user's permissions and potentially gain greater access or control over the victim's account or session.

How urgent it is

This vulnerability is already being used in attacks. Update affected software promptly because opening a malicious link or interacting with a compromised page can enable exploitation.

Who is affected

Affected versions include Adobe Commerce up to and including 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 in their respective branches; Adobe Commerce B2B up to and including 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 in their respective branches; Magento Open Source up to and including 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 in their respective branches; and Adobe Commerce Events up to and including 1.20.0.

What to do

Consult the Adobe advisory and update each affected product to a release that Adobe confirms resolves this flaw and is newer than the affected limit for your branch listed above. A specific fixed release and a workaround are not identified here.

How to check your server

Find the installed product name and version in its version information, then compare them with the affected branches and remediation guidance in the Adobe advisory.

Check your server for free →